Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 04:49
Static task
static1
Behavioral task
behavioral1
Sample
56c2c75f3eae96708ce3b0f8c0d98e48827e826eec0df30b83594968b4ffbf21.exe
Resource
win7-20220901-en
General
-
Target
56c2c75f3eae96708ce3b0f8c0d98e48827e826eec0df30b83594968b4ffbf21.exe
-
Size
190KB
-
MD5
fb0bffa32a19ea8f4819e80d1001bebf
-
SHA1
483db4b488f2ba09a487c88a8e0c14802d18f54a
-
SHA256
56c2c75f3eae96708ce3b0f8c0d98e48827e826eec0df30b83594968b4ffbf21
-
SHA512
2b711a3c97f95af7d9edf8617650ce8c8364de50b4938e9e87bd4d47a4e2ee3e66053f88ea50b6a8e99c95da445b5e021d956e6580daf9865dde4ad42c558c9b
-
SSDEEP
3072:1pzRNYuluupWyvbOijh7UAoaI52pySvl3nW0CWcscGF8ZHmt4qyluHE:1ZRvupm9UX5WflXW5Wc88wGXluk
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3248-133-0x0000000010000000-0x000000001004C000-memory.dmp upx behavioral2/memory/3248-134-0x0000000010000000-0x000000001004C000-memory.dmp upx behavioral2/memory/3248-135-0x0000000010000000-0x000000001004C000-memory.dmp upx behavioral2/memory/3248-136-0x0000000010000000-0x000000001004C000-memory.dmp upx -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 56c2c75f3eae96708ce3b0f8c0d98e48827e826eec0df30b83594968b4ffbf21.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\nsinet.exe 56c2c75f3eae96708ce3b0f8c0d98e48827e826eec0df30b83594968b4ffbf21.exe File opened for modification C:\Windows\SysWOW64\nsinet.exe 56c2c75f3eae96708ce3b0f8c0d98e48827e826eec0df30b83594968b4ffbf21.exe -
Drops file in Program Files directory 12 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Instant Access\Center\NoCreditCard.lnk 56c2c75f3eae96708ce3b0f8c0d98e48827e826eec0df30b83594968b4ffbf21.exe File created C:\Program Files (x86)\Instant Access\Multi\20091012101020\Common\module.php 56c2c75f3eae96708ce3b0f8c0d98e48827e826eec0df30b83594968b4ffbf21.exe File created C:\Program Files (x86)\Instant Access\Multi\20091012101020\medias\button1.gif 56c2c75f3eae96708ce3b0f8c0d98e48827e826eec0df30b83594968b4ffbf21.exe File created C:\Program Files (x86)\Instant Access\Multi\20091012101020\medias\button4.gif 56c2c75f3eae96708ce3b0f8c0d98e48827e826eec0df30b83594968b4ffbf21.exe File created C:\Program Files (x86)\Instant Access\Multi\20091012101020\medias\button2.gif 56c2c75f3eae96708ce3b0f8c0d98e48827e826eec0df30b83594968b4ffbf21.exe File created C:\Program Files (x86)\Instant Access\Multi\20091012101020\medias\button3.gif 56c2c75f3eae96708ce3b0f8c0d98e48827e826eec0df30b83594968b4ffbf21.exe File created C:\Program Files (x86)\Instant Access\Multi\20091012101020\dialerexe.ini 56c2c75f3eae96708ce3b0f8c0d98e48827e826eec0df30b83594968b4ffbf21.exe File created C:\Program Files (x86)\Instant Access\Center\NoCreditCard.lnk 56c2c75f3eae96708ce3b0f8c0d98e48827e826eec0df30b83594968b4ffbf21.exe File created C:\Program Files (x86)\Instant Access\Multi\20091012101020\medias\dialer.ico 56c2c75f3eae96708ce3b0f8c0d98e48827e826eec0df30b83594968b4ffbf21.exe File created C:\Program Files (x86)\Instant Access\Multi\20091012101020\js\js_api_dialer.php 56c2c75f3eae96708ce3b0f8c0d98e48827e826eec0df30b83594968b4ffbf21.exe File created C:\Program Files (x86)\Instant Access\Multi\20091012101020\instant access.exe 56c2c75f3eae96708ce3b0f8c0d98e48827e826eec0df30b83594968b4ffbf21.exe File created C:\Program Files (x86)\Instant Access\DesktopIcons\NoCreditCard.lnk 56c2c75f3eae96708ce3b0f8c0d98e48827e826eec0df30b83594968b4ffbf21.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\dialerexe.ini 56c2c75f3eae96708ce3b0f8c0d98e48827e826eec0df30b83594968b4ffbf21.exe File created C:\Windows\dialexe.zl 56c2c75f3eae96708ce3b0f8c0d98e48827e826eec0df30b83594968b4ffbf21.exe File created C:\Windows\dialexe.epk 56c2c75f3eae96708ce3b0f8c0d98e48827e826eec0df30b83594968b4ffbf21.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF1C8E21-4045-4D67-B528-335F1A4F0DE9} 56c2c75f3eae96708ce3b0f8c0d98e48827e826eec0df30b83594968b4ffbf21.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF1C8E21-4045-4D67-B528-335F1A4F0DE9}\LocalServer32 56c2c75f3eae96708ce3b0f8c0d98e48827e826eec0df30b83594968b4ffbf21.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF1C8E21-4045-4D67-B528-335F1A4F0DE9}\LocalServer32\ = "C:\\Windows\\SysWow64\\nsinet.exe /run" 56c2c75f3eae96708ce3b0f8c0d98e48827e826eec0df30b83594968b4ffbf21.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3248 56c2c75f3eae96708ce3b0f8c0d98e48827e826eec0df30b83594968b4ffbf21.exe 3248 56c2c75f3eae96708ce3b0f8c0d98e48827e826eec0df30b83594968b4ffbf21.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\56c2c75f3eae96708ce3b0f8c0d98e48827e826eec0df30b83594968b4ffbf21.exe"C:\Users\Admin\AppData\Local\Temp\56c2c75f3eae96708ce3b0f8c0d98e48827e826eec0df30b83594968b4ffbf21.exe"1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3248
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:5024